feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

1. Add flag to DH keys when using safe parameters.

Browse Source 
2. The LN check is skipped when using safe parameters.
3. Enable all FFDHE parameter sets when building for FIPS 140-3.
This commit is contained in:
John Safranek
2021-01-28 16:54:41 -08:00
parent 8ab396cb45
commit 5343092346
3 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
configure.ac
View File

@@ -2955,7 +2955,7 @@ fi
# FIPS # FIPS
AS_CASE([$FIPS_VERSION], AS_CASE([$FIPS_VERSION],
["v4"], [ # FIPS 140-3 ["v4"], [ # FIPS 140-3
AM_CFLAGS="$AM_CFLAGS -DHAVE_FIPS -DHAVE_FIPS_VERSION=4 -DWOLFSSL_KEY_GEN -DWOLFSSL_SHA224 -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB -DHAVE_ECC_CDH -DWC_RSA_NO_PADDING -DWOLFSSL_VALIDATE_FFC_IMPORT -DHAVE_FFDHE_Q" AM_CFLAGS="$AM_CFLAGS -DHAVE_FIPS -DHAVE_FIPS_VERSION=4 -DWOLFSSL_KEY_GEN -DWOLFSSL_SHA224 -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB -DHAVE_ECC_CDH -DWC_RSA_NO_PADDING"
ENABLED_KEYGEN="yes"; ENABLED_SHA224="yes"; ENABLED_DES3="no" ENABLED_KEYGEN="yes"; ENABLED_SHA224="yes"; ENABLED_DES3="no"
# Shake256 is a SHA-3 algorithm not in our FIPS algorithm list # Shake256 is a SHA-3 algorithm not in our FIPS algorithm list
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_SHAKE256" AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_SHAKE256"
@@ -2980,7 +2980,9 @@ AS_CASE([$FIPS_VERSION],
[ENABLED_SHA512="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA512 -DWOLFSSL_SHA384"]) [ENABLED_SHA512="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA512 -DWOLFSSL_SHA384"])
AS_IF([test "x$ENABLED_AESGCM" = "xno"], AS_IF([test "x$ENABLED_AESGCM" = "xno"],
[ENABLED_AESGCM="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AESGCM"]) [ENABLED_AESGCM="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AESGCM"])
AM_CPPFLAGS="$AM_CPPFLAGS -DUSE_CERT_BUFFERS_3072 -DUSE_CERT_BUFFERS_4096" AM_CFLAGS="$AM_CFLAGS -DUSE_CERT_BUFFERS_3072 -DUSE_CERT_BUFFERS_4096"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_VALIDATE_FFC_IMPORT -DHAVE_FFDHE_Q"
AM_CFLAGS="$AM_CFLAGS -DHAVE_FFDHE_3072 -DHAVE_FFDHE_4096 -DHAVE_FFDHE_6144 -DHAVE_FFDHE_8192 -DFP_MAX_BITS=16384"
], ],
["v3"],[ # FIPS Ready ["v3"],[ # FIPS Ready
AM_CFLAGS="$AM_CFLAGS -DHAVE_FIPS -DHAVE_FIPS_VERSION=3 -DWOLFSSL_KEY_GEN -DWOLFSSL_SHA224 -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB -DHAVE_ECC_CDH -DWC_RSA_NO_PADDING -DWOLFSSL_VALIDATE_FFC_IMPORT -DHAVE_FFDHE_Q" AM_CFLAGS="$AM_CFLAGS -DHAVE_FIPS -DHAVE_FIPS_VERSION=3 -DWOLFSSL_KEY_GEN -DWOLFSSL_SHA224 -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB -DHAVE_ECC_CDH -DWC_RSA_NO_PADDING -DWOLFSSL_VALIDATE_FFC_IMPORT -DHAVE_FFDHE_Q"

8
wolfcrypt/src/dh.c
View File

@@ -944,6 +944,7 @@ int wc_InitDhKey_ex(DhKey* key, void* heap, int devId)
#else #else
(void)devId; (void)devId;
#endif #endif
key->trustedGroup = 0;
return ret; return ret;
} }
@@ -1066,7 +1067,9 @@ static int GeneratePrivateDh186(DhKey* key, WC_RNG* rng, byte* priv,
pSz = mp_unsigned_bin_size(&key->p); pSz = mp_unsigned_bin_size(&key->p);
/* verify (L,N) pair bit lengths */ /* verify (L,N) pair bit lengths */
if (CheckDhLN(pSz * WOLFSSL_BIT_SIZE, qSz * WOLFSSL_BIT_SIZE) != 0) { /* Trusted primes don't need to be checked. */
if (!key->trustedGroup &&
CheckDhLN(pSz * WOLFSSL_BIT_SIZE, qSz * WOLFSSL_BIT_SIZE) != 0) {
WOLFSSL_MSG("DH param sizes do not match SP 800-56A requirements"); WOLFSSL_MSG("DH param sizes do not match SP 800-56A requirements");
return BAD_FUNC_ARG; return BAD_FUNC_ARG;
} }
@@ -2293,6 +2296,8 @@ static int _DhSetKey(DhKey* key, const byte* p, word32 pSz, const byte* g,
if (ret == 0 && q != NULL) { if (ret == 0 && q != NULL) {
if (mp_read_unsigned_bin(&key->q, q, qSz) != MP_OKAY) if (mp_read_unsigned_bin(&key->q, q, qSz) != MP_OKAY)
ret = MP_INIT_E; ret = MP_INIT_E;
else
key->trustedGroup = trusted;
} }
if (ret != 0 && key != NULL) { if (ret != 0 && key != NULL) {
@@ -2328,7 +2333,6 @@ int wc_DhSetKey(DhKey* key, const byte* p, word32 pSz, const byte* g,
return _DhSetKey(key, p, pSz, g, gSz, NULL, 0, 1, NULL); return _DhSetKey(key, p, pSz, g, gSz, NULL, 0, 1, NULL);
} }
#ifdef WOLFSSL_KEY_GEN #ifdef WOLFSSL_KEY_GEN
/* modulus_size in bits */ /* modulus_size in bits */

1
wolfssl/wolfcrypt/dh.h
View File

@@ -75,6 +75,7 @@ struct DhKey {
#ifdef WOLFSSL_ASYNC_CRYPT #ifdef WOLFSSL_ASYNC_CRYPT
WC_ASYNC_DEV asyncDev; WC_ASYNC_DEV asyncDev;
#endif #endif
int trustedGroup;
}; };
#ifndef WC_DH_TYPE_DEFINED #ifndef WC_DH_TYPE_DEFINED